ClawHub
Back to skill

Security audit

GuanXing 观星

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese metaphysics API wrapper; it sends user-provided reading details to GuanXing, but I found no hidden local file access, persistence, or deceptive behavior.

Install only if you are comfortable sending birth dates, names, dreams, relationship details, and personal questions to the GuanXing service. Avoid entering sensitive secrets, and do not treat crypto or fortune output as financial, medical, or legal advice. If you use the optional MCP or publishing commands from the docs, pin and verify npm package versions first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:55
Finding

Unpinned npm Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md:55
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- **MCP Server**: `npx @guanxing1/mcp-server` — for Claude, Cursor, Windsurf

Technical Analysis

The documentation recommends executing @guanxing1/mcp-server through npx without specifying an exact version or integrity value. If the package is not already available locally, npx can retrieve its current release from the configured npm registry and execute it.

Because the MCP package is not included in this repository, its implementation and lifecycle behavior were outside the audited codebase and could not be verified. The effective executable payload can change independently after this skill has been reviewed. A compromised package owner, npm account, release process, or registry response could therefore cause users following the documentation to execute unauthorized code.

Attack Path

  1. An attacker compromises the npm package owner, publishing credentials, release pipeline, or package distribution channel.
  2. The attacker publishes a malicious version of @guanxing1/mcp-server.
  3. A user follows the README and runs npx @guanxing1/mcp-server.
  4. npx resolves and downloads the current package version because no reviewed version is pinned.
  5. Package lifecycle scripts or application code execute with the privileges of the invoking user.
  6. The malicious package can access resources available to that account, subject to operating-system controls.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, the package could access local files, environment variables, API credentials, MCP client configuration, or network-accessible resources. The exposure concerns the separately distributed npm package ...[truncated 131 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the command to an exact release that has undergone security review, for example npx @guanxing1/mcp-server@X.Y.Z.
  • Publish verifiable provenance and integrity information for the reviewed package artifact.
  • Instruct users to verify the package name, version, publisher, and integrity before execution.
  • Disable or review npm lifecycle scripts where operationally possible.
  • Run the package in an isolated, least-privilege environment without unnecessary credentials or filesystem access.
  • Establish dependency monitoring and revoke or deprecate compromised releases promptly.

T08 · Insecure Dependencies

Warning
Location
PUBLISH.md:5
Finding

Mutable Global Installation of Publishing CLI

Content
View full analysis

Vulnerability Details

File Location: PUBLISH.md:5-8
Vulnerability Type: Unpinned global build and publishing dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## 1. Install ClawHub CLI (if not already)
```bash
npm install -g clawhub@latest
text

### Technical Analysis

The publishing instructions install the mutable `latest` release of the `clawhub` npm package globally. The `latest` tag can be reassigned to a different artifact after this repository has been audited, so the command does not guarantee execution of a known or reviewed version.

npm installation may execute package lifecycle scripts. A global installation also makes the tool persist in the user's command environment and increases its exposure beyond a single isolated publishing operation. This is a supply-chain weakness rather than evidence that the current `clawhub` package is malicious.

### Attack Path

1. An attacker compromises the `clawhub` package, maintainer credentials, release workflow, or npm distribution channel.
2. A malicious release is assigned to the npm `latest` tag.
3. A maintainer follows `PUBLISH.md` and runs `npm install -g clawhub@latest`.
4. npm downloads the attacker-controlled release and may execute its installation lifecycle scripts.
5. The installed CLI subsequently runs in the maintainer's publishing environment.
6. Malicious code can attempt to access available credentials, alter source or publication artifacts, or publish tampered content using the maintainer's authorized session.

### Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the account running npm. In a publishing environment, exposed assets may include source files, Git credentials, authentication sessions, environment variables, and ClawHub publication access. If npm is run with elevated permissions, impact could extend to globally writable installation paths or other resour
...[truncated 145 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, security-reviewed version.
  • Prefer a project-local development dependency governed by a lockfile instead of a global installation.
  • Verify package provenance, signatures, and registry integrity before using the CLI.
  • Execute publication tooling in an ephemeral, isolated, least-privilege environment.
  • Provide the publishing process only the minimum credentials required and rotate credentials if package compromise is suspected.
  • Review package lifecycle scripts and use installation controls that prevent unnecessary scripts where compatible with the tool.
  • Periodically update the pinned version through a documented review and testing process rather than tracking a mutable distribution tag.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file states users can 'immediately use it in any OpenClaw chat' and provides only Chinese trigger examples, implying the skill is intended to operate in Chinese by default. There is no indication that users may choose another language or that the Chinese-only usage is an explicit opt-in, which creates a locale/language policy concern.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

clawhub install guanxing

text

Or manually copy the `SKILL.md` file to `~/.openclaw/skills/guanxing/SKILL.md`.

## Setup

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

Setup

  1. Get a free API key at heartai.zeabur.app (Register → Developer Center → Create App)
  2. Set the environment variable:
    bash
    export GUANXING_API_KEY=gx_sk_your_key_here

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup requires an API key for an external service and the examples encourage users to submit highly sensitive personal data such as birth dates, dreams, compatibility details, and potentially financial interests. Without a clear disclosure that prompts and personal details are sent to a third-party API, users may unknowingly expose private information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README instructs users to run an unpinned package with npx, which fetches and executes the latest published code at runtime. If the npm package is compromised, typo-squatted, or updated maliciously, users and agents could execute attacker-controlled code without review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly allows autonomous invocation for broad topic matches like fortune, zodiac, Feng Shui, and related terms, which can cause the agent to send user prompts and personal data to a third-party API without sufficiently explicit user intent for data sharing. Because this skill processes sensitive personal inputs such as birth dates, names, questions, and compatibility data, broad triggering increases the chance of unanticipated external disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This skill sends personal and potentially sensitive user data to an external domain, including birth dates, names, dream descriptions, relationship information, and personal questions. Even though the transmission is over HTTPS and disclosed in the skill text, it still creates a real privacy and data-handling risk because the agent may forward user data to a third-party service outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

When the user asks about their birth chart, 八字, destiny, life path, or 命格:

bash
curl -s -X POST https://heartai.zeabur.app/api/v1/bazi \
  -H "Authorization: Bearer $GUANXING_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"birthDate": "YYYY-MM-DD", "birthHour": HOUR_0_TO_23, "name": "NAME"}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language interface examples all require Chinese phrases, which effectively imposes a language constraint on users. Under the language/locale policy rule, this should be flagged when a specific language is forced without explicit user opt-in or a clearly documented region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.